Navigation for DV Central

Launchpad: Click on items.
 
 

All new DV camcorders and DVCRS have embedded computers.  Computers can be programmed. And reprogrammed. If you know the code ...

 

 

Bounty Censored.

Secret broken.

Since inception of DV & Firewire central, we offered a bounty of $5000 for information leading to the apprehension of a procedure that unlocks the hidden PAL DV record on European DV camcorders. We haven't paid this bounty, and we also withdraw the offer. 
The Bad News.
The bad news is that lawyers at both sides of the Atlantic have warned us that we could be heading into major trouble should we pay the bounty and should the information be used by someone for commercial purposes.  This website is a labor of love. We aren't making any money off it. And we definitely don't want to spend our time and money with lawyers. So,  no more bounty. Especially not for a secret that could be used by someone else for commercial purposes while we pay the legal bills. 
The Good News.
The good news is that we have reason to believe that the secret has been  broken by an independent party. According to information available to us, PAL DV Record has been broken with at least one DV camcorder using a special remote control. The switch is persistent, i.e. it will not go away after the camcorder has been turned off. We are currently tracking this story and will reveal the source whenever the source is ready. The person who has broken the secret is currently deliberating how to go about it and what to do with the secret.  We will keep you posted. 

The Secret is Toast!

Codes to un-nEUter PAL DV input available on the 'net. Arik triumphs after all.

When we first reported that Arik Drori had cracked the secret of DV input for Sony’s PAL DV camcorders (see story below) he was ridiculed in newsgroups, and we were basically told to get a life. When the story of the odd VCM shenanigans (see story) was published, Arik decided to come forward with his findings. See his website.  Whole Europe ows  him a big THANK YOU and the flamerz owe him an apology. Arik is a true hero of high technology. And, we can't help to mention, the procedure pretty much works like what we assumed in May in our initial story on the subject.

Here is how it works: 

The Sony DV camcorders have pages of data which are stored in NVRAM (non volatile RAM). The data are organized a bit like the (in)famous modepages in SCSI drives. Pages contain data with  one-byte addresses and one-byte data, lookup-table style. The trick is to write the right data to the right addresses. 

Tools of the trade. 

RM-95To change data in your camcorder’s pages, you need to be able to access them. This is generally be done with a RM-95 remote control. Important: There are two kinds of RM-95. One is a handy remote with all the buttons (even zoom & focus) and a LCD display that shows timecode etc. It plugs into your camcorder or VCR via the LANC port. It’s nice to have anyway, for instance for those tripod shots. According to reports, this unit has been discontinued in 1993, so if Sony says that they aren’t making it anymore, they aren’t necessarily lying.  But they do have  another version.  It’s basically a modified RM-95 (see picture). The genuine article will have a little label on it’s back that read "Remote commander for Adjustment." It is a tool for service technicians and its serial # is J-6082-053-B . The most important part is the "Hold" switch at the upper left, which has been modified to switch from normal operation to adjustment mode (see picture). 

How to use the RM-95. 

Connect the RM-95 to the LANC port of your camcorder. For the PC7, you need the VMC-LM7 21-pin adapter. This will also give you audio inputs. The use of the RM-95 is described in detail in the service manual for your camcorder (see: "Availability of  tools".)  Here just the nitty-gritties: When the RM-95 goes into adjustment mode, the timecode display actually shows the data for the values in the individual pages. The format is  p:dd:aa, where p is the page, dd is the data and aa is the address. Values are displayed in hex. 
  • Increment/decrement the page with the search+/search- buttons. 
  • Increment/decrement the data with the play and stop buttons. 
  • Increment/decrement the address with the FF and REW  buttons. 
  • To write the data into NVRAM, hit PAUSE on the RM-95 

Kids, don’t try this at home. 

Please be notified that writing the wrong data into NVRAM can seriously impede the health and usability of your DV camcorder. Know what you are doing, always note the initial values in case you goof. Do exploratory writing of data at your own peril. Your camcorder may die in the name of science. You have been warned

Availability of tools. 

In the US, both the remote and the service manuals are available, but it usually takes some asking around. Sony doesn’t seem to be interested in turning this into a big business. Going through a helpful dealer or 3rd party service center usually does the trick. For this, it helps to have established good relationships beforehand.  DV-L correspondent David Clarridge Zartman writes: "Any Sony-authorized shop, and independent shops too, have these devices. Go to them and ask to use their RM-95 to adjust your camcorder. A couple of guys here were interested in the procedure since they had yet to work on digital cameras that way, and told me to come on by. Never hurts to ask. Get the vibe of the service tech and decide how much info you want to divulge about what you want to do. It helps to sound like you know what the heck you're talking about. Talk the talk. If they've never done a dig cam before, don't let them do it now unless you feel confident that they can figure it out correctly." He's right. See above. A proper service manual is extremely helful. It explains the use of the RM-97 in detail, it also gives you the (documented) NVRAM settings. Tinkerers will immediately zero-in on the undocumented stuff. Manual # 9-973-919-11 for instance covers the PC7 in all its variants, PAL, NTSC, even the infamous PAL "Tourist Model" (the one that records). Manual # 9-973-814-11 covers the  all VX 1000 models. Outside of the US, these tools may be hard or impossible to get, depending on where you are and who you ask. Try different approaches, we've heard stories of the RM-95 not being available in  the UK, but in Belgium they had five.  With these reports hitting the net hard, it's totally possible that the unit might disappear totally for a while.

What’s the code? 

For the code to unlock DV in on a PAL PC7, please refer to Arik’s website. I’m sure the codes will be lifted from his site and shot around the globe in no time, but credit where credit is due. Important: The procedure given at Arik's site works only for the PC7. Use the procedure on another camera and kiss it good-bye. We mean it! 

The future. 

Now that the code is out, it’s open season. For a short time, the limited availability of the RM-95 will make things hard, but it’s a LANC controller and it can be easily replicated.  Serial-to-LANC adapters are readily available.  Arik could write a little shareware program that unlocks one or two features and that gives you the whole shebang for, say, $49.  That’s more like it than the $500 the folks in Munich ask. 
 


Secret of nEUtered PAL units finally broken. Quick-change artists turn a fast Deutschmark.

Have your  PAL VX1000, VX9000, PC7 enabled to record via Firewire. If you don't mind the clumsy cloak & dagger routine.

As we all know, the case of the nEUtered Firewire inputs, and  activities  concerning  it’s successful demise are dear to our heart. Many have cheered us on, some (who, quite coincidentally work for companies who profit from this sad state of affairs) told us: "Forget it, enabled Firewire record on camcorders will never happen in Europe. Never." 

We don’t think so.  For quite some time already, the theoretical possibility of enabling REC in PAL DV camcorders sold in Europe has been beyond question. If you ask the right person at Sony, even they will confirm that it can be done. All you need is the right code. Which Sony treats as a state secret. Sony banks on nobody finding the needle in a haystack of 3 x 255 x 255 combinations. Harder codes have been broken. And it was just a matter of time for this one. The time has come

DV-L subscriber Christian Rogge reports from Munich: "Today I visited a Video Club in Munich and they showed me a European VX1000 with DV-IN enabled. For recording DV they used a cheap no name remote control where you must put in a vendor code. Then a DV cable with signal on it must be plugged to the DV-Connector. On the Display appear the two words: "DV IN". And it works." Roger reports that the club offered to "modify my camera for $ 300 in a backroom within 10 Minutes. They said that the camera will not be opened." 

No need to fiddle with the innards of the VX1000: What the "club" is using is most likely a unit offered  by a German company called "VCM Geraetemarkt." They were known as a low-key broker for used video equipment.  Recently, they started  advertising a "DV IR-Remote to enable DV-Input for VX1000/9000, PC7." The unit is offered at around $450 with the price going up to $500 after July 15th. 

Sony is well advised to keep an eye on these developments. It’s not good for their business when customers are driven into dark alleys and  "clubs" that want to turn customers’ predicament into quick Deutschmarks or Dollars . Sony usually donesn't leave money on the table if they can help it. 
 

Latest humint on VCM and who's behind them.  Addresses, fax and telephone numbers provided by our spies in Munich.

Latest developments,  reported by our agents dispatched to Bavaria: The Munich „VCM Geraetemarkt" which offers "DV IR-Remote to enable DV-Input for VX1000/9000, PC7"   either smartened up (remotes can be cloned - duh!) or they are engaged in a little deceptive advertising - you be the judge. 

Anyway: When you order one of these remotes that purportedly enable PAL DV input, VCM eventually tells you that they „have changed their mind" and that there is now a different procedure: You have to send them your camcorder, they change it, and then they give you a remote that operates the record function, it doesn’t enable it. They enable it. Price: Same as advertised before. Around $500. 

The „VCM Geraetemarkt" is an odd outfit. It consists of a faxback number (+49 89 780 9887) which sends you their pricelist automatically when you poll their fax (list is in German, but content is pretty obvious). They also have a telephone number (+49 89 755 3208), but that goes to an answering machine which announces that you should get current info from the faxback number. If you want to talk to a human, you are required to call - get this - „on every Wednesday after 6pm. This is also when we meet at the familiar location." In Germany, where until recently every shop had to close at 6:30 pm by law (after 50 years of discussion, they extended it to 8 pm ...), opening on Wednesdays only, and after 6pm, could be considered appropriate for a swinger's club, but not for a market for video equipment. 

Hmmm, do we detect slightly hackish behavior here?  We’re currently trying to confirm that VCM is the very Video Club in Munich which Christian Rogge mentioned in his report, but due to VCM’s spartan availability on the phone, this will have to wait a while. It’s a pretty good assumption though. 

And maybe it’s a front. Eagle-eyed DV-L  subscribers in Germany remembered that they had seen a similar telephone number in an ad that appeared in the German magazine „Kameramann." That number  was +49 89 755 9867 - only slightly different than VCM’s faxback number. The advertised number belongs to the Munich firm „Video Systeme Hoehnleitner," which resides in Bayerbrunner Str. 22  81379 Muenchen. 

We called them and asked „We understand you have a device that switches VX 1000 into record mode?" They said: „That’s correct." When asked to divulge details, the nice lady manning the telephone said: „Our technicians are not around. Could you please send us a fax with your telephone number so that we can call you back?" Hmmm, an odd routine, what’s wrong with writing down our number? When we asked her for their fax number, the lady said: „Munich 780 9887."  Same fax as that odd VCM outfit that meets only on Wednesdays after 6pm  „at the familiar location." Looks like whoever operates that DV switcheroo service is trying to cloak their activities somewhat, but they should stick to electronics and leave the spycraft to professionals. Or maybe they've watched too many videos? 

Anyway: You can send your record neutered PAL VX1000, VX9000 or PC7, to „Video Systeme Hoehnleitner"  and for the paltry sum of around $500, they will enable record and send it back to you, along with a remote that operates the thing. Forget cloning that remote,  because it only works the record function, it doesn’t enable it. The saga continues.... 

PS: For those who don't already have a DV camcorder, "VCM Geraetemarkt" also offers VX 1000  and VX 9000  with PAL record enabled, although at somewhat higher prices. A "3 week old demo model"  of an rec enabled  VX1000 goes for approx $3300,  they sell a "new" model  for $150 less.  Expect this to turn into a trend with rec enabled camcorders sold under the counter, "for a slight surcharge" and most probably with a voided warranty.  Sony, are you reading this?


Euros Riled About nEUtered DV Gear, Threaten to Kick Butt.  

As Firewire boards are becoming available in Europe (available: FAST DVMaster, soon to be available: Spark, FireMax, MotoDV et al) European DV enthusiasts are getting increasingly riled about the lack of DV input in their camcorders. Like modern day Marie Antoinettes, the DV camcorder makers say to their Firewire-impoverished European populace: "Let them eat cake." Or rather "let them buy expensive DVCRs" at $4000 a pop. 

At a recent press conference, where Panasonic announced that they will finally equip some of their DV wares with Firewire, Panasonic’s announcement that their EU Firewire will be one-way only (as it is the - well - custom in Europe) was met with loud expressions of disgust, emanating from an otherwise well-behaved crowd of journalists. 

Marie Antoinette ended on the guillotine of the French Revolution. And already, video-revolutionaries like Bob Crabtree, Editor of the new UK Magazine Computer Video, are openly recommending bodily harm as the solution to the problem: "I'll be slipping on my hobnails, in preparation for giving camcorder makers a swift boot up the behind,“ announces Crabtree in the editorial of Computer Video’s July issue. "Huge, supposedly wise, multinational companies haven't the wit to kick-start this new-age properly in Europe - one of their prime markets - by ensuring that the digital camcorders they sell have digital  inputs.“  Bob's magazine even coined a new and extremely befitting expression for the different classes of DV camcorders: "Neutered“ and "Intact.“ 

Let's hope that the days of nEUtered DV camcorders are numbered. Otherwise, history may repeat itself.


26year old Tel Aviv student: "I have cracked the secret of enabling DV input" in DV PAL camcorders.

As described below, Sony has disabled the record capability in their European PAL models. Sony claims this is to avoid substantial customs surcharges. Many customers would be more than willing to pay an extra 15% for a PAL VX-1000 that also records. But "no dice," says Sony. 

Sony better re-evaluate their policy, because Ariel "Arik" Drori, a 26 year old student of electronics who lives with his wife in Tel-Aviv, Israel, claims that he cracked the recording capability of DV PAL camcorders. What's more, Arik promises to unlock a whole panoply of features at the push of a LANC controller: 

  • Enable 16x9 on all models. 
  • Make your NTSC camcorder work in PAL, or vice versa 
  • Improve light sensitivity. 
  • Prevent drop in quality when using electronic "steadyshot" in low light, and more. 
According to Arik, he has been hacking analog camcorders for years, enabled locked analog inputs, added features etc. In several telephone conversations with DV & Firewire Central, Arik Drori claimed that he successfully cracked a Sony PC7, using the LANC connection via a Sony VMC-LM7 Lanc & audio adapter.  

DV & Firewire Central immediately arranged for a demonstration of the capability. The meeting never happened. As indicated in the sidebar, lawyers in the US and Europe counseled against money changing hands in exchange for an industry secret. The meeting was called off and we could not verify the claims. Said Arik in his website: "There was a prize for the first one to find [the secret], but the sponsors chickened out on me!" You bet we did. Better chicken than a chicken without a head. 

Arik, who ended his 5 year career in the Israeli Defense Forces as a Sergeant Major, is hoping to commercialize his findings. For more details, check Arik's website. He offers to modify your camcorder after you send the unit to Israel, but so far, he didn't have any takers. 

Said one VX-1000 owner in the US who contacted Arik Drori to have 16:9 enabled: "He did offer to perform the conversions for me, but that would have meant sending him my camcorders, so I wasn't willing to take that risk to see if the theory was true." Instead, the VX-1000 owner contacted several Sony service centers in the Seattle area for service manuals, but no luck: "After talking to the Sony Service Center, I got the impression that this is indeed a well-kept Sony secret." 

Despite his claim that "The secret of DV Input for the European market is OUT," Arik is playing his cards close to his chest. So far he resisted pleas to publish his findings. Arik indicated that he is willing to sell his knowledge for commercial exploitation, but according to legal and industry experts consulted by DV & Firewire Central, it is highly unlikely that this knowledge will ever go commercial: 

  • Modifying DV units would violate the rules of the "CE" label, the European cousin of the FCC or UL label. Modified units would be illegal to operate within the boundaries of the EU. This may be a technicality, but many lawsuits are lost or won on technicalities. 
  • Changing new PAL or even NTSC units into Recording PAL units would immediately turn them into "used" equipment without warranty. 
  • Selling a gizmo that would plug into the LANC socket could be defensible from a legal standpoint, but LANC codes sent to the camcorder could be easily intercepted and the unit could be cloned by anybody. Said an industry insider contacted by DV & Firewire Central: "The secret would have a lifetime of 5 minutes. Nobody in his right mind will invest money in such a venture." 
  • And whatever you do, there's always the possibility of Sony suing for damages. They may not prevail, but not too many companies or individuals look forward to a protracted legal battle with a 500 pound gorilla. 
So there you have it. The key to enabling PAL record and possibly a number of other highly interesting features of your DV camcorders sits in a small apartment in Tel-Aviv. If you are interested, send Arik some mail. 

While Arik Drori is pondering what to do with his secret, relief is on its way in a manner that is less likely to attract legal beagles: Sony DV camcorders with PAL record capability have been sighted in non-EU countries such as Hungary, Romania, Dubai, and even in Arik's Israel. First batches are already winding their way through the walls of Fortress Europe. 

And for those of you who don't want to buy a second DV camcorder: There's always the possibility of hooking a computer controlled LANC unit to your camcorder and do some "War Games" style dialing. Details about the LANC protocol, the hardware and software needed can be found at Adrian Verity's Control-L Homepage. And there's the faint hope that Arik may go public with his information some day. 

 

 


Importers of Rec-Enabled PAL DV Cams Complain about Sony Strongarm Tactics.

Several European dealers and distributors have attempted to import Sony DV PAL camcorders which can record via Firewire. (For more background on the missing capability, see below.) None of the would-be importers have succeeded so far. Their stories all sound the same. "I had no problem locating the PAL camcorders in Japan," reports one German dealer who placed an order for 70 PAL VX1000's with a Japanese distributor. The distributor took the order, but a few weeks later, says the German dealer, the order was declined. Reports the angry German importer: "The distributor was notified that should one of the record-enabled camcorders be traced to the EU, this would be the last product he would ever receive from Sony." The German dealer is now looking into alternative sources. 

Secret Switchcraft.

The best known "secret" VX1000 trick is the "hidden" colorbar trick. In case you don't already know, here's how: 

On your VX1000, turn the red start/stop button to "lock" with the camera/vtr knob turned to "camera." Press one finger down on the rec/start/stop button to "lock" with the camera/vtr knob turned to "camera." Keep one finger on the rec/start/stop button on top of the camera and another finger down on the "photo" button next to the zoom controls. Now, while keeping those two buttons depressed, turn the red start/stop buttons to standby,. And you'll have color bars. To reset, turn the camcorder off and back on. One DV-L correspondent noted by the way that this trick does not work on the VX700. Gosh, they even strip hidden features! No shame. 

Also works on DSR-200: 

According to DV-L list correspondent Richard of VantagePoint Imaging, Inc.,  "the color bar activation sequence also works on the DVCAM DSR-200 except you press the record button on the front of the camcorder." 

How to unlock the locked audio "feature" on the DSR-30.

If you try to edit from a DV unit (VX1000 etc.) to  Sony's  DSR-30 (the DVCAM variant of the DHR1000)  via Firewire, you will find out: It  doesn't work. Why? DV works in unlocked audio, DVCAM works in locked audio. The DSR-30 refuses to take footage with unlocked audio. But it can be talked into it at the touch of two buttons: 

The DSR-30 can be put into a mode that will allow it to record UnLocked or Non-Standard Audio.  All you have to do is power off, then hold both the REC and PAUSE buttons down and power up, you should hear a long tone and then presto, you can now feed it locked or unlocked audio and it will record.  The deck is reset when you power down.  

An apPALling situation. And pointers how to fix it (some day).

If you live in  PAL territory and if you think you can simply copy DV back & forth between the computer and your VX1000 or PC7, as explained in DV & Firewire editing workflow,  then you'll quickly find out: You can output through Firewire on your PAL units, but you can't input. The reason behind this is that in the EU, anything that inputs video is classified as a VCR. If it doesn't record video, it's classified as a camera. What's the difference? Around 10% higher import duty. Some people have argued that DV isn't video, but simply digital data, but apparently, the European customs official didn't buy that line (if it ever was officially offered). 

What you have to do is  buy a DHR1000 DVCR just to be able to record your edited video Your friends in NTSC territory can happily use their camcorder for that purpose. 

What's worse, even countries which are not part of the EU, but have PAL as their standard, are affected. In Australia and NZ for instance, VX-1000s cannot record, but the PC7 can. 

Report from the UK: "It's the remote control." 

David Bryant writes from the UK: "I have spent a long time and a lot of research tracking down information about DV in enabled camcorders and sources of the PAL version outside the UK.   I was even getting somewhere with the possibility of getting a DV enabled DSR-200 until Sony phoned Japan and had the company policy laid down to them. It seems inevitable that Broadcasters and commercial clients over here are going to demand the option of DV in now the  firewire cards are out. From what I already know the cameras seem to boot up similar to a computer and carry all the relevant setup in a bios of some sort." 

David relates an interesting conversation which "took place between myself and a Sony Broadcast person who had better remain nameless" on the subject of importing a DV in enabled DSR-200 camera into the UK: 

SBP..." I have spoken to Japan and there is no way they can divert one of the enabled PAL models from Dubai into Europe even if you are prepared to pay the duty. You see they are not C.E.(Council of Europe) safety stamped....." 

Me....."Ok well in that case why can't you take the case off  one of the ones you have and switch  the jumper and I'll give you the £400 import duty then." 

SBP..."Well it's the remote control not a jumper but at the moment this is just not an issue we can even consider.... now maybe we should reconsider the warranty arrangements if you do go ahead and get them  from the Sony dealer in Dubai....." 

Factoids:

A Sony person confirmed that "it can be done in seconds if you know how." 

European developers who bought Sony's DVBK-1 hardware CODEC chipset have been told how to change the camcorders so that they can test their products. These folks have been sworn to secrecy and probably threatened with an immediate loss of their supply if word comes out. No leaks so far. 

There have been several reported cases where VX-1000 or PC7 were "taken into a room", "taken behind the curtain at a trade show" by Sony people, and voila, when they came out, they recorded PAL. Usually, they lost that capability when the unit was switched off. 

Assumptions, rumors: 

  There is a well guarded diagnostic unit in Europe that allows Sony technicians to change the units. That must be one of the reasons why most work on Sony DV camcorders must be done at the factory. It is unclear whether this diagnostic unit is attached via Firewire or via that mysterious connector that's hidden under a cover in the battery compartment of the VX1000. 

  There is a country table embedded in all Sony DV units that has all pertinent info (such as video system, record, non record etc.) associated with the individual country or region. Find access to that table and you have the key to nirvana. Note: Supposedly, Sony DV models are identical , i.e. there are no functional differences between PAL or NTSC units etc., all differences are programmed through the country table.  

  Temporary enabling  of the PAL record function can be done with a switch sequence during startup. This switch sequence is presently unknown, but it's something similar to the well published enable colorbars sequence.  Hint: For this sequence to function, the firewire cable must be inserted into the camcorder and it must be activated. 

  Sony is understandably paranoid about any information leaking out. As it appears, they don't want to force you into buying a DHR1000 (although they may welcome the side effect), what they are most worried about is that they may have to retroactively pay the higher customs duty on all  DV units exported to Europe. DV unit sales in Europe have been estimated to be around 1 Million units since shipments had begun in late 95, so payments could be considerable. 

Any further insights into these matters would be highly welcome. 


News. Links. Products. We want your input. 

 
     

Last Updated October 11, 2007

Written mostly by Bertel Schmitt.  Maintained by Alexei Gerulaitis.

Copyright © 1997-2007 DV Central.  All trademarks recognized.

Home ] DV-L ] Firewire ] What is DV? ] DV News ] Products ] Gallery ] Links ] Input ] Sponsors ]